Cloud Native Computing Foundation KubeCon + CloudNativeCon China 2019 (Shanghai), 5 Jul 2019

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Deep Dive: Kubernetes Policy WG - Zhipeng Huang, Huawei

Description

Join us for Kubernetes Forums Seoul, Sydney, Bengaluru and Delhi - learn more at kubecon.io

Don't miss KubeCon + CloudNativeCon 2020 events in Amsterdam March 30 - April 2, Shanghai July 28-30 and Boston November 17-20! Learn more at kubecon.io. The conference features presentations from developers and end users of Kubernetes, Prometheus, Envoy, and all of the other CNCF-hosted projects

Deep Dive: Kubernetes Policy WG - Zhipeng Huang, Huawei

In this session we will cover the progress Kubernetes Policy WG had made during the first half year of 2019, some of the policy related k8s KEPs, and also new plannings for the next half year regarding unified policy object, cloud native policy white paper

https://sched.co/Nrqw

A

So welcome to the pure energies policy working group session, so we are a small working group.

A

Part of the motivation actually count comes from the chief architect, Brian grant from Google, so Brent grant always envisioned policy framework being one of the like the top two shapes of communities in the future that, when it is true, should transform to Sao Paulo is always like a big thing on his mind from ourselves. What we find necessary to form a policy working group is because that you, basically you, can find policy defined in many places in kubernetes you have Paul security policy, which is a big, a big one, and you have network policy.

A

You have our back policy, you have many policy, but if you ask just ask anyone what is community's policy so I doubt anyone can give a concrete answer to it. So that's actually part of the problem. That policy is defined like scattered or all around the place. And another thing is that policy description, Artemus effect in nature. We got questions from people like. Are we going to define a single policy description language through the working group?

A

But the answer is probably no, because policy language is very tricky and domain-specific, so we we don't think we can standardize that but whoa well. What the working group is focusing on is the policy semantics and the control mechanism, so these are things that is universal and could be standardized or generalized. So this is our focus and also policies policies like very important in many other aspect outside of kubernetes, for example.

A

This is the own app policy project and if you have a similar background, like I did with, like writing telco standard twelve years ago, you know policy plays a big part in the IMS.

A

That was an Jian standard like a decade ago.

A

So policy is important and policy is scattered around, so we want to form a working group to try to come up with the architecture, as I said, to have a standardized control mechanism, and this is what working, what the purpose of the working group. This is a relationship with the different six. As you can see, we keep in touch with many SIG's, like scheduling admission storage network, also like multi-tenancy working group.

A

So we and also working group in urban areas by definition, is across multiple six okay, so we we all, we always have a list of working items for every half year. So this is the work items we focus on for the first half a year, probably will keep focusing on for the second half of this year, so multi-tenancy, gatekeeper and pause occur, pause security policy.

A

These are the three big items we will be focusing on for the kubernetes site and we have also some new ideas, very forward-looking, almost research items, if you are interested, you are welcome- to participate. Okay, so multi-tenancy multi, multi tendency has always been a big problem for kubernetes.

A

There has been a very smoke promotes proposed by Google and other companies like Heart, multi-tenancy or soft multi-tenancy, so I think the multi-tenancy working group currently is running a proposal basically have a tenancy Rd to populate the the tenancy resource view tenant as a resource and populate the resource. We are sir d, so the policy. Why do we need a policy here? The policy here is to help basically to tell the tendency Rd like where to stop.

A

So the policy will describe what the limits a tenant will have and help automate the process of populate the lieutenant.

A

So, as you can see, the these are the like: I pick it up from the design document from the multi-tenancy, and so in a nutshell. We, by defining a policy we help solving the the custom resource population problem.

A

So a simple idea is something like we can utilize the gatekeeper project and so babe. So basically, we define a tenon policy object. So in that upon the object we described like what she should be applied to certain tenant and then the cake keeper will help like mapping the positive addition to the general communities working mechanism.

A

So there's still problem like how do we define the constraint for a population, so the big the biggest problems do is: when do we see the wall and stop so? This is still like an interesting area for us to explore.

A

The second one is the cake keeper project so for those of you are now familiar with cake. Keeper is a project spearhead by Microsoft and other companies work with the open policy agent project. So it's basically a policy CRD project, so cake keeper, like helps define a way that you can use policy to do like a dimension, control and other stuff in kubernetes through OPA through OPA, so cake keeper is I. Think project is very promising.

A

They have made a lot of progress and we'll keep working very closely with a cake keeper project and also there will be some very interesting planning for oppa, like wasum support, very interesting for us. Another big big thing. The third item is the pol security policy migration. So there are discussions about actually migrate.

A

The pod security policy of the core communities mechanism into a like olive tree operation, so big keeper, is actually one of the toys under consideration by cigars, and so we are also work very closely with Kay keeper folks to see if we can use gate keeper actually to do the pall security policy.

A

How do we do that and I think this is one of the one of the most interesting experiment we'll be conducting in the second half of this year, so some new things, the first new experiment we also running- is the formal verification for policy, so formal verification is sort of not the type of thing you usually thinking about for cloud. Computing is usually done mostly in research, so you have a way of formally verify a mechanism and I identify many of the corner cases.

A

So what we find interesting for policy is that we need a way to know how the policy is defined correctly and also when the policy is enforced executed, whether it is executed correctly.

A

So there's comes the proposal for the formal verification, so I will spare you the details. If you are familiar with the first order logic, you be familiar with the SMT solvers, so basically, this is what the formal verification is. So there's a. We try to verify this logic expression.

A

There are many open-source 70s over. We can take into consideration. I think these three IIST it's the most mentioned one.

A

So in order to do the form verification, one thing we need to do for policy is to actually construct a symbolic graph to abstract the the policy description for kubernetes. So for each domain the graph will be different. For example, you for networking will be looking at something like this come and go, and for multi-tenancy will be something like this right.

A

You have a privilege, escalation or de-escalation from the like the route to many of the tenant use you populated and for security, mostly likely you have like this type of graph, so each domain probably will have different graphs.

A

Ok, so the current discussion, we are having discussion with the AWS, automated reasoning group, also with folks from GP, more JP Morgan, because banking, the financial industry like having the biggest requirement for the formal verification.

A

So the current target is to looking at the use case for privilege escalation because privilege escalation is useful, for you know several use cases, for example, for the kubernetes operator, lifecycle management for multi-tenancy and also like in issue like out of communities. Israel also has the problem of doing the privilege escalation or the escalation.

A

So if you are also interested, you can send me an email or the other working group, co-lead Erica to contact us policy has a type system.

A

So basically you can view the kubernetes policy as a like as a type for your whole cluster, so similar to the type we know for the programming language at integer floating point. The Paulo here actually serves as a constraint so as a type system.

A

So basically, a policy or criminal. Its policy defines these four things and.

A

So I also I won't go into details. I think one of the one of the the things that we want to emphasize is a policy different from configuration.

A

In a way that policy expect result, so when you define a policy, you have to define the result and when a certain action is taken, you know there has to be either reward or punishment for for certain result. But for configuration you do note about the you. Don't expect a certain result. You just config.

A

Okay, just couple examples of how like how we view policy as type system so outside of kubernetes. We also have, since my collaboration. We are part of the since they have security seek, so we are also constructing a cloud native policy white paper. So this is the architecture we are currently having. As you can see, we have for our verification policy. Engine and a compiler in a sense of community are the controller.

A

So if you are interested, you are also welcome to contribute to the white paper.

A

Okay, so the best way to like to contribute or come in contact with the working group is to look at the document. We have document for all the meeting minutes agenda. Although me all the information is on this document. If you've gone slack, we are on work, coupon see or you go to the seek security channel. We are on there as well. Okay,.

B

You may want I, don't want you.

B

Mayo Doha yummy yummy 20 min ki, shallow jolly daddy's idea to be one sir hi Daddy. Thank you very much.